WeMates
Legal
Privacy Policy
Last updated: July 2026 · Applies to wemates.es and all WeMates products.
This policy describes how personal data is handled across the WeMates platform. Where WeMates provides its roommate-matching service to a student residence or coliving operator (a "Residence"), the Residence is the data controller and WeMates acts as a data processor on its documented instructions. WeMates is the controller only for its own website and business contacts, as set out below.1. Who We Are and Our Role
WeMates is a B2B software platform that provides roommate-matching services to student residences and coliving operators.
Two distinct roles apply:
- Processor — for the survey data of students placed by a Residence. The Residence decides why and how this data is used and is the controller; WeMates processes it solely to deliver the matching service, under a Data Processing Agreement and on the Residence's instructions.
- Controller — for our public website, the contact form, and the accounts of Residence staff who use our dashboard.
We do not have a designated Data Protection Officer (DPO). Privacy enquiries are handled by our Privacy Committee at info@wemates.es.
2. Who This Policy Covers
- Students completing the compatibility survey at a participating Residence.
- Residence staff who access the WeMates management dashboard.
- Website visitors and anyone who contacts us via the website.
3. What Data We Collect
We practise data minimisation: we collect only what the service needs. Importantly, student survey data is pseudonymised, not anonymous — it is linked to a booking reference through which your Residence can re-identify you, so it remains personal data under the GDPR. We do not collect students' names or email addresses in the survey.
a) Student survey data (WeMates as processor)
- Booking reference — an identifier issued by your Residence; the only link back to you.
- Lifestyle & living-preference answers — sleep schedule, cleanliness, social habits, study noise and similar (20 structured questions).
- Free-text answers — open questions about your habits and what you would find difficult in a roommate.
- Language(s) you speak.
- Date of birth — used to derive age as a compatibility factor.
- Gender — used solely to honour the Residence's same-gender room-allocation rules. See Section 4.
- Nationality — collected only where your Residence requires it for its own administrative or census records, on the Residence's instruction. It is not a factor in our matching algorithm.
b) Website & business data (WeMates as controller)
- Contact form — the name, email and message you submit. These are stored in our database so we can follow up.
- Residence staff accounts — name and email of dashboard users, for authentication.
- Language preference — stored in your browser's local storage only.
4. Special Category Data (Article 9 GDPR)
Two things you may provide are special categories of personal data under Article 9 GDPR: your gender identity and — only if you choose to answer them — the optional questions about your values, which can reveal political or philosophical views. We treat them with particular care.
- Why we collect them. Residences allocate shared rooms on a same-gender basis, so gender is recorded to honour that requirement. The values questions help find a compatible roommate but are entirely optional — you can skip them and still complete the survey. Neither is used to profile you.
- Legal basis. We process it on your explicit consent (Article 9(2)(a) GDPR), which you give before starting the survey.
- Your control. You may withdraw your consent at any time and ask your Residence to delete your survey responses. Withdrawal does not affect processing already carried out.
5. Why We Use Your Data and Our Legal Basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Compute compatibility and suggest room assignments | Survey data (Section 3a) | On behalf of the Residence (controller). Gender and the optional values answers (special category): your explicit consent, Art. 9(2)(a) |
| Reply to a contact enquiry | Contact form (Section 3b) | Consent / our legitimate interest, Art. 6(1)(a)/(f) |
| Provide dashboard access to Residence staff | Staff account | Performance of our contract with the Residence, Art. 6(1)(b) |
| Keep the service secure and working | Technical/access logs | Legitimate interest, Art. 6(1)(f) |
We do not sell, rent, or transfer your data to any third party for marketing or advertising, and we do not use it to build profiles beyond the roommate match described here.
6. Automated Matching — and Human Oversight
WeMates uses an algorithm to suggest compatible pairings and room assignments. These are proposals, not final decisions: your Residence's staff review the results and can adjust, swap, or override any assignment before it takes effect. Because a person at the Residence reviews and decides, the placement is not a solely-automated decision producing legal effects under Article 22 GDPR. If you have concerns about a suggested match, contact your Residence. Your Residence receives the assignment proposal and a pseudonymised compatibility view — identified only by your booking reference, without your name or contact details — to review and finalise room allocations.
7. Who Processes Your Data (Sub-processors)
We rely on the following sub-processors, each bound by a Data Processing Agreement:
- Supabase — database and authentication hosting (Ireland, EU).
- Railway — runs the matching computation on the survey data (Amsterdam, Netherlands, EU).
- HubSpot — CRM for website contact-form enquiries (EU data centre, eu1). Only contact-form data; never student survey data.
We do not add new sub-processors that materially affect student data without the Residence's agreement as required by our Data Processing Agreement.
8. International Transfers
All personal data — including survey responses and contact-form submissions — is stored and processed exclusively within the European Economic Area (Supabase, Ireland; Railway, Netherlands; HubSpot, EU data centre). We make no transfer of data outside the EEA whatsoever.
9. Data Retention
- Survey and matching data — retained for as long as your accommodation contract with the Residence lasts (including renewals — so a returning student never has to answer again), then, within a maximum of 60 days of its end, either deleted or irreversibly anonymised — permanently unlinked from any personal identifier so that no individual can be re-identified — for WeMates' aggregate statistical and service-improvement purposes. This aggregate statistical use is explicitly authorised in the Data Processing Agreement (DPA) signed with the Residence. The Residence, as controller, may instruct a different period for its own legal obligations.
- Contact-form data — kept for up to 12 months after our last correspondence with you, then deleted.
- Staff accounts — kept for the duration of the Residence contract.
10. Your Rights
Under the GDPR you have the right to:
- Access a copy of your data.
- Rectify inaccurate data.
- Erase your data ("right to be forgotten").
- Restrict or object to processing.
- Data portability — receive your data in a machine-readable format.
- Withdraw consent at any time, without affecting processing already carried out.
For student survey data, your Residence is the controller, so the fastest route is to contact them directly; as processor, WeMates will support and act on their instruction. For website or contact-form data, or if you are unsure who to ask, email us at info@wemates.es and we will respond within one month. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD), aepd.es, or your local supervisory authority.
11. How We Protect Your Data
Student data is pseudonymised (no names or emails in the survey), encrypted in transit, and access is restricted so each Residence can only ever see its own data (row-level security). Staff accounts are individual and password-protected.
12. Cookies & Local Storage
We use browser local storage only to remember your language preference. We do not use tracking cookies, advertising cookies, or third-party analytics that profile your behaviour.
13. Minors
The WeMates platform is designed for use by university students (generally aged 16 or over). As the data controller, it is the Residence's sole responsibility to ensure that users invited to the platform have the legal capacity to give consent under their jurisdiction.
14. Changes to This Policy
We may update this policy. Material changes affecting students will be communicated through the Residence or shown prominently on our website, with an updated date at the top of this page.
15. Contact
Questions about this policy or your data? Email us at info@wemates.es.